🚀 go-pugleaf

rind@enterprise.bih (David Rind) writes:

> Does Joshi trap attempts at warm reboots?  There was an intermittent
> problem with a new program on a computer that turned out
> to be infected with Joshi.  The problem was sporadic enough that I
> can't be certain that getting rid of Joshi eliminated it, but if
> Joshi was trapping Alt-Ctrl-Del, then that would explain the "bug".

Yes, Joshi intercepts INT 9 (the keyboard interrupt) and checks for
Alt-Ctrl-Del. If it is detected, the virus tries to "survive the warm
reboot". That is, it clears the screen, restores the interrupt vectors
it has saved while it has been loaded in memory, and issues INT 19h.
This will actually reboot the computer without cleaning the memory,
thus the virus will not be destroyed.

A careful user will not be fooled by that, because most machines
display a lot of messages during the warm reboot. These messages come
from the BIOS. Unfortunately, this is not reliable enough, because
most people are not careful and will not make the difference between a
real warm reboot and the virus just blanking the screen (i.e., no
messages). On the top of that, some computers (mainly true IBM PC or
PS/2s) do not display any messages during the warm reboot...

This has created the myth that some viruses are able to survive a warm
reboot. They cannot, or at least they cannot do this unnoticeably on
most computers, but nevertheless you are always advised to cold-boot
when you suspect a virus in memory...

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.1 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany